AZ-104 Practice Exam 58 — 20 Questions

Question 1

Based on the exhibit, which restore option should the administrator choose?

Accepted Answer

File recovery, because it restores individual files or folders from the VM backup.. File recovery is the correct option because the administrator needs to restore a specific deleted file from a VM backup without restoring the entire VM. Azure Backup's file-level recovery allows mounting the backup as a drive (via iSCSI) to browse and copy individual files or folders, which directly addresses the requirement.

Answer

Recreate VM, because it restores the entire virtual machine from the backup point.

Answer

Backup policy, because it defines which files are included in the restore operation.

Answer

Recovery point, because it is the portal action used to mount a deleted file directly.

Question 2

A route table contains a user-defined route for 172.16.0.0/16 to a virtual appliance. The ExpressRoute circuit advertises 172.16.10.0/24. A VM in the subnet sends traffic to 172.16.10.20. Which route does Azure use?

Accepted Answer

The BGP route, because it has the more specific prefix length.. Azure uses the most specific prefix match to determine the next hop. The BGP route for 172.16.10.0/24 has a longer prefix length (24) than the user-defined route for 172.16.0.0/16 (16), so the BGP route is preferred regardless of route source priority. This follows the longest prefix match (LPM) algorithm, which overrides the default preference order of UDRs over BGP routes.

Answer

The user-defined route, because UDRs always beat BGP routes.

Answer

The system route to the virtual network, because system routes are preferred over learned routes.

Answer

No route is chosen because Azure does not support overlapping prefixes.

Question 3

A company is creating a new spoke virtual network that will be peered to an existing hub VNet. The hub uses 10.40.0.0/16, and an on-premises network already uses 10.41.0.0/16. The spoke must support about 120 endpoints now and should allow room for growth. Which address space should you assign to the new spoke VNet?

Accepted Answer

10.42.0.0/24. (10.42.0.0/24) is correct because it provides 256 IP addresses (251 usable) for the spoke, which exceeds the requirement of ~120 endpoints with room for growth, and it does not overlap with the hub VNet (10.40.0.0/16) or the on-premises network (10.41.0.0/16). This ensures successful VNet peering without IP address conflicts.

Answer

10.40.64.0/25

Answer

10.41.128.0/24

Answer

192.168.10.0/26

Question 4

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Accepted Answer

A metric alert rule on the VM CPU metric. A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.

Answer

A Recovery Services vault

Answer

A private endpoint for the virtual machine

Answer

A blob lifecycle management policy

Question 5

An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.

Accepted Answer

Create a user-assigned managed identity that can be attached to both Azure resources.. A user-assigned managed identity provides a secure, credential-free authentication method for Azure resources. It allows both the Function App and Automation runbook to authenticate to Azure Storage without storing any secrets, meeting the requirement to avoid stored secrets.

Answer

Store the storage account access key in both app settings and runbook variables.

Answer

Assign Contributor on the storage account because it automatically includes all blob data permissions.

Answer

Use a shared SAS token without an expiration date for both workloads.

Question 6

A finance team stores application blobs in an Azure Storage account. The data must remain available if a single availability zone in the region is lost, and the team does not need automatic read access from another region. Which redundancy option best meets the requirement?

Accepted Answer

Zone-redundant storage (ZRS), which replicates data across availability zones in the same region.. Zone-redundant storage (ZRS) replicates your data synchronously across three Azure availability zones within the primary region. This ensures that if a single zone fails, the data remains available and durable without requiring any manual intervention or failover, meeting the requirement of no automatic read access from another region.

Answer

Locally redundant storage (LRS), which keeps three copies in one datacenter only.

Answer

Geo-redundant storage (GRS), which replicates data to a paired region and supports failover.

Answer

Read-access geo-redundant storage (RA-GRS), which allows reads from the secondary region.

Question 7

A development team needs to run a Linux container for about 12 minutes each time a request is received. The team does not want to manage a server, cluster, or virtual machine. Which Azure service should the administrator use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows the team to run a Linux container directly in Azure without managing any underlying infrastructure, such as servers, clusters, or virtual machines. ACI is ideal for short-lived, event-driven workloads like this 12-minute request-based container, as it supports rapid startup and automatic shutdown, aligning with the 'serverless' requirement.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machines

Answer

Azure App Service

Question 8

A hub VNet already has a VPN gateway connected to on-premises networks. A new spoke VNet must reach those on-premises networks through the existing gateway without deploying another gateway. Which peering settings are required?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. To allow a spoke VNet to use the hub VNet's VPN gateway without deploying its own, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to route traffic destined for on-premises networks through the hub's VPN gateway, leveraging the existing site-to-site VPN connection.

Answer

Enable forwarded traffic on both peerings and leave gateway settings disabled.

Answer

Enable use remote gateways on the hub peering and gateway transit on the spoke peering.

Answer

Create a private endpoint between the two VNets.

Question 9

Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?

Accepted Answer

An Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.

Answer

A custom RBAC role assigned at each subscription

Answer

A CanNotDelete lock on each subscription

Answer

A budget alert on each subscription

Question 10

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-App. A private DNS zone linked to VNet-App is required because Azure Private Endpoint uses a private IP address from the virtual network, but the storage account's fully qualified domain name (FQDN) must resolve to that private IP within the VNet. By linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to VNet-App and configuring an A record for the endpoint's private IP, VMs can resolve the storage account name to the correct private address. Without this, DNS resolution would fall back to the public IP, defeating the purpose of the private endpoint.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

An Azure Firewall policy

Question 11

A build pipeline needs to run a Linux container for about 15 minutes whenever a request arrives. The job never needs inbound traffic, clustering, or persistent node management. A second workload is a public web app that needs built-in TLS, deployment slots, and autoscale. Which two Azure compute services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first workload because it allows you to run a Linux container on demand without managing any underlying infrastructure, and it supports a 15-minute execution time perfectly with its per-second billing and no requirement for persistent nodes or inbound traffic. Azure App Service is correct for the second workload because it natively provides built-in TLS/SSL termination, deployment slots for staging and swapping, and autoscale capabilities out of the box, making it ideal for a public web app.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machines

Answer

Azure Functions

Question 12

An operations team wants to know when Azure marks a specific storage account unhealthy because of a regional platform issue. They do not want to depend on a custom metric, a Log Analytics query, or any polling script. What should they create?

Accepted Answer

A resource health alert for the storage account. A resource health alert is the correct choice because it directly monitors the health of a specific Azure resource, such as a storage account, and triggers when Azure detects a platform-level issue that marks the resource as unhealthy. This alert does not require custom metrics, Log Analytics queries, or polling scripts, aligning perfectly with the team's requirement to avoid those dependencies. Resource health alerts are designed to notify you of service-impacting events originating from the Azure platform, not from your own configuration or usage patterns.

Answer

A metric alert on storage capacity because platform issues always reduce capacity first

Answer

A log alert that searches AzureDiagnostics for unavailable status codes

Answer

An activity log alert on every write operation to the storage account

Question 13

An administrator moved a blob to the Archive tier last month. A user needs to open it tomorrow. What must happen before the file can be read?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. To read a blob in the Archive tier, it must first be rehydrated to the Hot or Cool tier. This process, called rehydration, changes the blob's tier and makes it accessible for reading. Until rehydration completes, the blob remains offline and cannot be read.

Answer

Create a snapshot of the archived blob

Answer

Enable versioning on the storage account

Answer

Move the storage account to LRS redundancy

Question 14

Arrange the steps to deploy an Azure Policy that enforces tagging on resources.

Accepted Answer

Navigate to Azure Policy, then create a policy definition, then assign the policy definition, then test the assignment.. Deploying an Azure Policy that enforces tagging requires first navigating to the Azure Policy service, then creating a policy definition with the appropriate rule, assigning it to the desired scope (e.g., subscription or resource group), and finally testing to ensure the policy works as expected. Incorrect orders may lead to errors or ineffective policy enforcement.

Answer

Create a policy definition, then assign it, then navigate to Azure Policy, then test the assignment.

Answer

Assign the policy definition, then create it, then test, then navigate to Azure Policy.

Answer

Navigate to Azure Policy, then assign the policy definition, then create a policy definition, then test the assignment.

Question 15

A company hosts a stateless web application behind a load balancer. Traffic increases during the day and drops at night. The team wants Azure to automatically add or remove identical VM instances based on demand. What should the administrator deploy?

Accepted Answer

A virtual machine scale set. A virtual machine scale set (VMSS) is the correct choice because it automatically manages a group of identical, load-balanced VMs and can scale out (add VMs) or scale in (remove VMs) based on demand metrics like CPU usage or a schedule. This matches the requirement for a stateless web application with variable traffic, as VMSS integrates with Azure Load Balancer or Application Gateway and supports autoscale rules to handle daytime spikes and nighttime drops without manual intervention.

Answer

A single large virtual machine

Answer

An availability set

Answer

A managed image

Question 16

Match each file-sharing requirement to the best Azure Files mounting or integration approach.

Accepted Answer

SMB: Requires storage account credentials and port 445 for mounting. SMB mounting requires storage account credentials; NFS needs private endpoint; REST API for programmatic access; Azure AD DS enables identity-based access; File Sync caches on-premises.

Answer

Azure AD DS: Used for programmatic access to Azure file shares

Answer

File Sync: Enables identity-based access to Azure file shares

Question 17

A build pipeline must run a Linux container for about 10 minutes per request. The team does not want to manage servers or a Kubernetes cluster. Which Azure service should the administrator choose?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a Linux container directly on Azure without managing any underlying servers or orchestrators. The 10-minute execution time fits perfectly within ACI's per-second billing model, and the service automatically starts and stops the container on demand, making it ideal for short-lived, ephemeral workloads like build pipeline tasks.

Answer

Azure Virtual Machines

Answer

Azure App Service

Answer

Azure Kubernetes Service

Question 18

A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Accepted Answer

Create a private endpoint for the storage account in the subnet. A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.

Answer

Enable blob versioning on the storage account

Answer

Assign a ReadOnly lock to the storage account

Answer

Enable a shared access signature

Question 19

A stateless customer portal runs on Azure VMs and must keep serving traffic if an entire datacenter in the region fails. The operations team also wants the portal to add and remove instances automatically during daily spikes without managing a Kubernetes cluster. Which two Azure compute capabilities should the administrator configure? Select two.

Accepted Answer

Deploy the portal instances across availability zones.. Availability zones protect against a full datacenter failure by distributing VM instances across physically separate datacenters within a region. This ensures that if one datacenter goes down, the portal continues serving traffic from the other zones. Combined with a load balancer, this provides high availability for stateless workloads.

Answer

Place the VMs in an availability set within a single datacenter.

Answer

Create a proximity placement group for the portal VMs.

Answer

Use a single larger VM with premium managed disks.

Question 20

A workload uses Azure Blob Storage for customer uploads. The team wants protection against a datacenter failure within the primary region and wants data copied to a paired region for disaster recovery, but they do not need to read from the secondary region during normal operations. Which redundancy option fits best?

Accepted Answer

GZRS. GZRS (Geo-Zone-Redundant Storage) is correct because it combines ZRS within the primary region (synchronously replicating data across three Azure availability zones) with asynchronous geo-replication to a paired secondary region. This provides protection against both a datacenter failure (via ZRS) and a full region failure (via geo-replication), while the lack of read access from the secondary during normal operations matches the requirement exactly.

Answer

ZRS

Answer

RA-GZRS

Answer

GRS